Why the source matters
When you install a program, you give it permission to run on your device, often with wide access to your files. A malicious or tampered installer does not need to trick your antivirus or your browser. It only needs you to run it. That is why the place you download from matters more than any scan you run afterward.
Safe software downloads rest on a simple idea: get programs from the people who actually make them, through channels that are hard to fake.
Prefer official stores where they exist
Phones, tablets and many computers have an official app store. Apps there are usually reviewed and run with restrictions, which lowers risk, though it does not remove it. Harmful or deceptive apps have occasionally made it through. So even in an official store, check the developer name, read recent reviews critically and look at the permissions requested.
On a computer, an official store or package manager, where your system has one, is often a better first choice than a random website. It also makes updating easier, which is a security benefit in itself.
Go to the publisher directly
If a program is not in a store, find the maker’s own website. The most reliable method is to avoid search results and ads as your starting point. Search ads in particular can place a look-alike page above the real one. A better approach is:
- Type the publisher’s address yourself if you know it, or use a bookmark.
- If you only know the program’s name, search for it, then look closely at the domain before clicking. Spotting lookalike web addresses is a useful skill here.
- Look for a download link on the publisher’s own pages, not on third-party sites that wrap the file in their own installer.
- Check that the address matches the one mentioned in the program’s documentation, in a reputable review or on the developer’s other official pages.
Warning signs of a poor source
Be cautious when you see any of the following:
- A site that offers a paid program for free, or a “cracked” version.
- A page with several large, similar “Download” buttons, where some are advertisements.
- A download manager or “installer” that you must run first, rather than the program itself.
- An address that resembles the real one with extra words, swapped letters or an unusual ending.
- A pop-up claiming that you need to install something to view a video or fix a problem.
- A link in an unexpected email or message.
Unofficial copies of popular software are a well-known route for unwanted extras. The reasons are covered in more detail in our look at why pirated software carries hidden risks.
Beware of bundled extras
Even legitimate installers sometimes offer additional programs, such as toolbars or trial software, often pre-ticked. Read each screen of an installer instead of clicking through. Choose a custom or advanced install when offered, decline extras you do not want and look at what the program says it will change. If an installer will not proceed without accepting something unrelated, that is a reason to rethink.
Verifying what you downloaded
A few checks are available to most people.
Look at the file name and type. An installer should look like what it claims. A program called a document or picture but ending in an executable type is a warning sign. Our guide to risky email attachments covers this idea further.
Check the publisher information. On some systems, the installer shows who signed it. If the publisher name is blank or does not match the maker, stop. Note that a signature shows who produced the file, not that the program is harmless.
Compare checksums when offered. Some publishers list a checksum, a long string that identifies the exact file. Your system can calculate one for the file you got, and if the two match, the file is the same as the one the publisher published. This is optional but useful for important tools.
Let your security tools weigh in. Built-in protection and browser warnings are a helpful extra check, not a guarantee.
Keep software updated from the same source
Many attacks use flaws in outdated programs, so install updates, preferably through the program’s own updater or your system’s store. Be suspicious of update prompts that appear in a web page rather than inside the program. Fake update notices are a common trick, in the same family as fake virus alerts.
Remove what you do not use
Each installed program is something that needs updating and could contain flaws. Once in a while, go through your list of installed programs and uninstall things you no longer use. Do the same for browser add-ons, since browser extension risks follow similar logic.
If you already installed something suspicious
Do not panic, and do not assume the worst. Disconnect from the network if you can, run your security software’s full scan and uninstall the program. Change important passwords from a different, clean device and check your accounts for unfamiliar activity. If you believe financial information was exposed, contact your bank. Keeping a recent backup makes recovery much easier, so build that habit before you need it.
A short routine
Choose the official store or the maker’s site, check the address, decline extras, install updates from the original source and remove what you do not use. These steps will not make every download risk-free, but they remove the most common ways that unwanted software arrives. This article gives general information, and menus and installer screens vary, so look at what each screen actually asks.